Who logged into a computer and when?

G

grandpa06

Registered
I was asked by another user of Macs, How can I tell when a user from a list of users logged in and used their account or another account.
I have never been asked this question before so I was puzzled on this one.
The system that this user is using OS X Leopard. He had user that came into his room and was on one of his computers that has at least 6 accounts. Someone used one of those accounts, but he is not sure why or which account they logged into. Is there a log that can be checked for access.
Thanks
 
Look at the log files in /var/log as well as /private/var/log/secure.log. Also check the "Console.app" which will allow you to perform searches through various log files.

Be warned that these log files are not written in plain English -- i.e., don't expect there to be anything close to English stating, "John Smith logged into this computer at 5:49pm on January 2, 2010." More than likely, you will see log entries to the effect of:
Code: 
17:49:35 user jsmith logged in
or
Code: 
WindowServer: jsmith logged in [1262476175]
...or something that may appear "cryptic" to those not versed in the language of UNIX.
 
You must log in or register to reply here.
Back
Top